IN THE CLAIMS 



This listing of claims will replace all prior versions, and listings, of claims in the 
application: 

Listing of Claims: 

1 . (Currently Amended) A method for generating fictitious computer file system content 
for a computing system configured to provide, to an intruder who has gained or is attempting to 
gain unauthorized access to a network with which the computing system is associated, a 
deception environment in which the intruder is allowed to access at least part of the generated 
fictitious computer file system content to keep the intruder from gaining access to a protected 
network resource located outside the deception environment, comprising: 

creating a plurality of templates; 

providing a collection of data items available to be inserted into the templates; 

selecting one or more of said templates; and 

for each template selected: 

automatically selecting at least one data item from the collection; and 
populating the template with the at least one data item from the collection; 

wherein for at least one selected template, selecting the at least one data item is 
based at least in part on the relative probability of occurrence of the at least one data item 
to make the deception environment more realistic by ensuring that data items occur with 
the frequency one would expect in a real, non-deception computing environment 
associated with network[[.]] ; and 

intentionally altering at least one populated template to introduce at least one 
spelling error to make the deception environment appear more realistic by ensuring that 
at least some of the generated file system content is not entirely free of spelling errors. 

2. (Original) The method of claim 1 wherein the collection of data items comprises one or 
more names. 

3. (Original) The method of claim 1 wherein the collection of data items comprises one or 
more dates. 
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4. (Previously Presented) The method of claim 1 wherein at least one template is an e-mail 
message requiring at least one item of data to be complete. 

5. (Previously Presented) The method of claim 1 wherein at least one template is a word 
processing document requiring at least one item of data to be complete. 

6. (Previously Presented) The method of claim 1 wherein at least one template is a 
spreadsheet requiring at least one item of data to be complete. 

7. (Previously Presented) The method of claim 1 wherein for at least one selected template 
the step of populating comprises receiving a number from a random number generator. 

8. (Original) The method of claim 7 wherein the random number generator is a pseudo 
random number generator. 

9. (Original) The method of claim 8 wherein the pseudo random number generator employs 
a unique key to generate numbers. 

10. (Previously Presented) The method of claim 1 wherein for at least one selected template 
the step of populating comprises correlating a random number to an item of data in the 
collection. 

1 1 . (Previously Presented) The method of claim 1 wherein for at least one selected template 
the step of populating comprises inserting an item of data into the template. 

12. (Previously Presented) The method of claim 1 further comprising intentionally including 
at least one spelling error in at least one template to make the deception environment appear 
more realistic by ensuring that at least some of the generated file system content is not entirely 
free of spelling errors. 

13. (Canceled) 

14. (Currently Amended) The method of claim 1 [[3]] wherein a random number is used to 
determine what the at least spelling error will be. 

15. (Previously Presented) The method of claim 1 further comprising intentionally 
introducing at least one grammatical error into at least one populated template to make the 
deception environment appear more realistic by ensuring that at least some of the generated file 
system content is not entirely free of grammatical errors. 

16. (Canceled) 
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17. (Canceled) 

1 8. (Previously Presented) The method of claim 1 wherein for at least one selected template, 
selecting the at least one data item is a function of (1) a random number and (2) the relative 
probability of occurrence of the at least one data item. 

19. (Original) The method of claim 1 8 wherein a pseudo random number generator provides 
the random number. 

20. (Canceled) 

2 1 . (Previously Presented) The method of claim 1 , further comprising associating a 
probability of occurrence with each template and wherein selecting one or more of said templates 
is based at least in part on the associated probability of occurrence. 

22. (Previously Presented) The method of claim 1 wherein at least one template requires that 
at least two items of data be compatible with one another. 

23. (Currently Amended) A system for generating fictitious computer file system content for 
a computing system configured to provide, to an intruder who has gained or is attempting to gain 
unauthorized access to a network with which the computing system is associated, a deception 
environment in which the intruder is allowed to access at least part of the generated fictitious 
computer file system content to keep the intruder from gaining access to a protected network 
resource located outside the deception environment, comprising: 

a computer configured to: 

select one or more of a plurality of templates; and 
for each template selected: 

automatically select at least one data item from a collection of data 
items available to be inserted into the template; and 

populate the template with the at least one data item from the 

collection; and 

a database configured to store the collection; 

wherein for at least one selected template, selecting the at least one data item is 
based at least in part on the relative probability of occurrence of the at least one data item 
to make the deception environment more realistic by ensuring that data items occur with 
the frequency one would expect in a real, non-deception computing environment 
associated with network; 
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• wherein the computer is further configured to intentionally alter at least one 
populated template to introduce at least one spelling error to make the deception 
environment appear more realistic by ensuring that at least some of the generated file 
system content is not entirely free of spelling errors. 

24. (Currently Amended) A computer program product for generating fictitious file system 
content for a computer for a computing system configured to provide, to an intruder who has 
gained or is attempting to gain unauthorized access to a network with which the computing 
system is associated, a deception environment in which the intruder is allowed to access at least 
part of the generated fictitious computer file system content to keep the intruder from gaining 
access to a protected network resource located outside the deception environment, the computer 
program product being embodied in a computer readable medium and comprising computer 
instructions for: 

selecting one or more of a plurality of templates; and 

for each template selected: 

automatically selecting at least one data item from a collection of data 

items available to be inserted into the template; and 

populating the template with the at least one data item from the collection; 

wherein for at least one selected template, selecting the at least one data item is 
based at least in part on the relative probability of occurrence of the at least one data item 
to make the deception environment more realistic by ensuring that data items occur with 
the frequency one would expect in a real, non-deception computing environment 
associated with networkfl".]] ; and 

intentionally altering at least one populated template to introduce at least one 
spelling error to make the deception environment appear more realistic by ensuring that 
at least some of the generated file system content is not entirely free of spelling errors. 

25. (Previously Presented) The method of claim 1 , wherein the collection includes at least 
one data item that is not fictitious. 

26. (Previously Presented) The method of claim 1 , wherein the deception environment is on a 
server. 

27. (Previously Presented) The method of claim 1 , wherein the deception environment is on a 
PC. 
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2 8 . (Previously Presented) The method of claim 1 , wherein the deception environment is part 
of a trap system. 

29. (New) A method for generating fictitious computer file system content for a computing 
system configured to provide, to an intruder who has gained or is attempting to gain 
unauthorized access to a network with which the computing system is associated, a deception 
environment in which the intruder is allowed to access at least part of the generated fictitious 
computer file system content to keep the intruder from gaining access to a protected network 
resource located outside the deception environment, comprising: 

creating a plurality of templates; 

providing a collection of data items available to be inserted into the templates; 

selecting one or more of said templates; and 

for each template selected: 

automatically selecting at least one data item from the collection; and 
populating the template with the at least one data item from the collection; 

wherein for at least one selected template, selecting the at least one data item is 
based at least in part on the relative probability of occurrence of the at least one data item 
to make the deception environment more realistic by ensuring that data items occur with 
the frequency one would expect in a real, non-deception computing environment 
associated with network; and 

intentionally including at least one spelling error in at least one template to make the 
deception environment appear more realistic by ensuring that at least some of the 
generated file system content is not entirely free of spelling errors. 

30. (New) A method for generating fictitious computer file system content for a computing 
system configured to provide, to an intruder who has gained or is attempting to gain 
unauthorized access to a network with which the computing system is associated, a deception 
environment in which the intruder is allowed to access at least part of the generated fictitious 
computer file system content to keep the intruder from gaining access to a protected network 
resource located outside the deception environment, comprising: 

creating a plurality of templates; 

providing a collection of data items available to be inserted into the templates; 
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- selecting one or more of said templates; and 
for each template selected: 

automatically selecting at least one data item from the collection; and 
populating the template with the at least one data item from the collection; 
wherein for at least one selected template, selecting the at least one data item is 
based at least in part on the relative probability of occurrence of the at least one data item 
to make the deception environment more realistic by ensuring that data items occur with 
the frequency one would expect in a real, non-deception computing environment 
associated with network; and 

intentionally introducing at least one grammatical error into at least one populated 
template to make the deception environment appear more realistic by ensuring that at 
least some of the generated file system content is not entirely free of grammatical errors. 
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